Ireland’s Data Protection Commission (DPC) has imposed a Google a sanction total of 403 million euros at the end of an investigation into the processing of location data of users. The authority ordered the company to adapt their processing methods to the GDPR within six months.
The investigation, launched by the DPC in February 2020, began after some reports submitted by European consumer rights organisations, including BEUC. The proceedings examined how Google Ireland Limited processed location data in the period between May 25, 2018date of application of the GDPR, and the February 4, 2020. In detail, the investigation concerned three features: Web & App Activity, Location History and Location Accuracy.
According to the ruling, Google has violated the GDPR in several respects. Regarding Web & App Activity and Location History, the DPC found violations relating to lawfulness and correctness of the processing of location data. The authority also accused Google of failing to comply with accountability obligations in relation to Location Accuracy, in particular due to the impossibility of demonstrating compliance with the principles of lawfulness, correctness and transparency.
The disputes also concern the obligations of transparency for all three features and the retention of location data for periods deemed excessive in the case of Web & App Activity and Location History.
Location data constitutes a particular category of personal information because it can allow you to reconstruct, directly or by combining them with other data, a person’s movements. In the provision the authority highlights that this information can increase the usefulness of online services, but also reveal potentially very private aspects of users’ lives.
The GDPR requires that personal data be processed lawfully, correctly and transparently throughout the European Economic Area. According to the DPC, the shortcomings found in the case of Google could have meant that users were not aware of the use of their location, including for purposes such as influencing through advertisements or inferring their interests.
A Google spokesperson said: “This case concerns previous policies that have since been updated. As of 2019, we have significantly improved our procedures and introduced effective tools which simplify the management of location data”.
